Access control for packet-oriented networks

Abstract

The invention relates to a method for access control to a packet-oriented network. Two admissibility checks for a group of packets are carried out by means of threshold values for the traffic transmitted via the network input node and the network output node for the flow. The transmission of the groups of data packets is not permitted when an authorization of the transmission would lead to traffic volume exceeding one of the threshold values. A relationship between the threshold values and the traffic volume in partial stretches or links may be formulated by means of the proportional traffic volume over the individual partial stretches. Using the capacities of the links the threshold values for pairs of input and output nodes can be fixed such that no overload occurs on the individual links. Within the above method a flexible reaction to the drop-out of links can be achieved by means of a resetting of the threshold values. Furthermore the inclusion of other conditions is possible, for example relating to the capacity of interfaces to other networks or special demands on transmission of prioritized traffic.

1 .- 11 . (canceled)  
     
     
         12 . A method for limiting traffic in a packet-oriented network having a plurality of links, the method comprising: 
 performing two admissibility checks for a group of data packets of a flow to be transmitted via the network, wherein    the first admissibility check is carried out using a limit value for the traffic routed via the network ingress node of the flow, wherein    the second admissibility check is carried out using a limit value for the traffic routed via the network egress node of the flow, and wherein    transmission of the group of data packets is not permitted, if the transmission would result in traffic exceeding one of the two limit values.    
     
     
         13 . The method according to  claim 12 , wherein limit values are determined for all network ingress nodes and network egress nodes for the traffic routed via the respective nodes.  
     
     
         14 . The method according to  claim 13 , wherein 
 a relationship is established between the limit values for the traffic routed via network ingress nodes or network egress nodes with the traffic volume on the links of the network, and wherein    the limit values for the traffic routed via the network ingress nodes or network egress nodes are determined using values for maximum traffic volume on the links of the network.    
     
     
         15 . The method according to  claim 14 , further comprising: 
 determining the proportional traffic volume via individual links of the network for pairs of network ingress nodes and network egress nodes; and    establishing the relationship between the limit values for the traffic routed via the network ingress nodes or network egress nodes with the traffic volume on links of the network using the values for proportional traffic volume via the individual links of the network.    
     
     
         16 . The method according to  claim 12 , wherein 
 a relationship is established between the traffic volume between pairs of network ingress nodes and network egress nodes and the traffic volume on links of the network using inequations, wherein    an optimization method for the traffic volume on links of the network is implemented, wherein 
 the inequations are used as secondary conditions for optimization, and wherein  
 the proportional traffic volume via individual links of the network is used to establish the relationship between the traffic volume between pairs of network ingress nodes and network egress nodes and the traffic volume on links of the network.  
   
     
     
         17 . The method according to  claim 13 , wherein 
 a relationship is established between the traffic volume between pairs of network ingress nodes and network egress nodes and the traffic volume on links of the network using inequations, wherein    an optimization method for the traffic volume on links of the network is implemented, wherein 
 the inequations are used as secondary conditions for optimization, and wherein  
 the proportional traffic volume via individual links of the network is used to establish the relationship between the traffic volume between pairs of network ingress nodes and network egress nodes and the traffic volume on links of the network.  
   
     
     
         18 . The method according to  claim 14 , wherein 
 a relationship is established between the traffic volume between pairs of network ingress nodes and network egress nodes and the traffic volume on links of the network using inequations, wherein    an optimization method for the traffic volume on links of the network is implemented, wherein 
 the inequations are used as secondary conditions for optimization, and wherein  
 the proportional traffic volume via individual links of the network is used to establish the relationship between the traffic volume between pairs of network ingress nodes and network egress nodes and the traffic volume on links of the network.  
   
     
     
         19 . The method according to  claim 15 , wherein 
 a relationship is established between the traffic volume between pairs of network ingress nodes and network egress nodes and the traffic volume on links of the network using inequations, wherein    an optimization method for the traffic volume on links of the network is implemented, wherein 
 the inequations are used as secondary conditions for optimization, and wherein  
 the proportional traffic volume via individual links of the network is used to establish the relationship between the traffic volume between pairs of network ingress nodes and network egress nodes and the traffic volume on links of the network.  
   
     
     
         20 . The method according to  claim 12 , further comprising: 
 performing a further admissibility check using a limit value for the traffic volume between the network ingress node and the network egress node for the flow.    
     
     
         21 . The method according to  claim 13 , further comprising: 
 performing a further admissibility check using a limit value for the traffic volume between the network ingress node and the network egress node for the flow.    
     
     
         22 . The method according to  claim 14 , further comprising: 
 performing a further admissibility check using a limit value for the traffic volume between the network ingress node and the network egress node for the flow.    
     
     
         23 . The method according to  claim 15 , further comprising: 
 performing a further admissibility check using a limit value for the traffic volume between the network ingress node and the network egress node for the flow.    
     
     
         24 . The method according to  claim 16 , further comprising: 
 performing a further admissibility check using a limit value for the traffic volume between the network ingress node and the network egress node for the flow.    
     
     
         25 . The method according to  claim 20 , wherein 
 a relationship is established between the traffic volume between pairs of network ingress nodes and network egress nodes and the traffic volume on the links of the network, and wherein    values for maximum traffic volume on the links of the network are used to determine limits for the traffic volume between the pairs of network ingress nodes and network egress nodes and limit values for the traffic routed via the network ingress nodes and the traffic routed via the network egress nodes.    
     
     
         26 . The method according to  claim 12 , wherein, if a link fails, the limits or the limit values for the admissibility check or admissibility checks are reset with the condition that no packets are transmitted via the failed link.  
     
     
         27 . The method according to  claim 13 , wherein, if a link fails, the limits or the limit values for the admissibility check or admissibility checks are reset with the condition that no packets are transmitted via the failed link.  
     
     
         28 . The method according to  claim 12 , wherein, for at least one admissibility check, limits or limit values dependent on a class of service of the group of packets are used.  
     
     
         29 . The method according to  claim 13 , wherein, for at least one admissibility check, limits or limit values dependent on a class of service of the group of packets are used.  
     
     
         30 . The method according to  claim 12 , wherein 
 for a majority of possible incidents limits or limit values respectively are determined, at which the traffic volume remains within a permitted frame, even in the event of an incident, and wherein    the limits or limit values are set to the minimum of the values for the incidents under examination.    
     
     
         31 . The method according to  claim 16 , wherein 
 at least one further relationship is established using an inequation, the further relationship expresses a traffic limitation on a link of the network or a link going away from the network, and wherein    the optimization method is performed by using a condition regarding said further relationship.